Comments on: Starting out with Glastopf http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/ Offensive and Defensive IT Security Thu, 02 Feb 2012 15:40:26 +0000 hourly 1 http://wordpress.com/ By: Anonymous http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-901 Fri, 12 Aug 2011 21:38:35 +0000 http://infosanity.wordpress.com/?p=389#comment-901 Andrew, what I’m willing to gain is the same as yours “study malware behavior”. I will Install & configure Kippo+Dionaea then just like you.

Is there any tools you use on top of those? For analysis or monitoring or anything you might find useful to tell me about, I will be appreciated.

Thanks for your reply.

]]> By: Andrew Waite http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-900 Fri, 12 Aug 2011 17:54:35 +0000 http://infosanity.wordpress.com/?p=389#comment-900 Ultimately depends what you’re hoping to gain from running honeypot sensors. I wouldn’t try to dissuade anyone from using Glastopf or any other system, just that I don’t have enough experience with Glastopf to be any help.

I’ve tried running most honeypot systems I’ve been able to get my hands on, and written about most of my experiences here. Each system had a different tact and provides different information.

I’ve scaled my honeypot farm back recently as I was needing to spend less time in my lab. I now just run Dionaea and Kippo, for the most part they just look after themselves with any problems. Plus both systems are actively developed, so when I do find extra time to play with new toys, I can build in some additional functionality to my existing systems without needing to build and learn new frameworks.

As I said first, technology dependes on exactly what you’re looking to gain from the technology. Just about everyone I know that uses honeypot systems use a different selection and configuration to match their needs.

Sorry if that doesn’t help too much, best advice I can give is to dive into everything see what works best for you.

]]> By: Anonymous http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-899 Fri, 12 Aug 2011 13:34:59 +0000 http://infosanity.wordpress.com/?p=389#comment-899 Okay, which Honeypot do you recommend then? Dionaea?

I have Kippo, Dionaea, etc running. Do you suggest I stick with Dionaea? I’m running it from the Mercury-dvd you posted once, but I’m thinking on moving to a clean install of it on a separate system.

Any suggestions would be really helpful to me.

]]> By: Andrew Waite http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-898 Fri, 12 Aug 2011 11:16:30 +0000 http://infosanity.wordpress.com/?p=389#comment-898 Afraid I don’t run Glastopf any more so can’t help too much. I ran into several problems and issues whilst setting up, likely similar issues that you’re finding now. As I run my sensors in my own time on top of a long work schedule I found I gained a better ROI from other honeypot systems.

I am still really interested in the Glastopf, and think the information that it’s designed to collect holds a definite interest. If you’re struggling with setup I’d suggest jumping into the glastopf irc channel, I got some great and rapid responses from Lukas and the rest of the channel.

]]> By: Anonymous http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-897 Thu, 11 Aug 2011 16:01:21 +0000 http://infosanity.wordpress.com/?p=389#comment-897 Hi Andrew,

I’m trying to get glastopf and glastopfng up and running, but some problems in that. Can you share the way you setup the systems?

Regards,

]]> By: Glastopf – First experiences « Diatel http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-412 Fri, 28 May 2010 12:26:24 +0000 http://infosanity.wordpress.com/?p=389#comment-412 [...] I will keep watching the logs and I will inform you of any interesting attack.  I recommend you to read Andrew Waite’s post about glastopf. [...]

]]> By: Andrew Waite http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-155 Wed, 02 Dec 2009 09:25:38 +0000 http://infosanity.wordpress.com/?p=389#comment-155 Hi Lukas,

thanks for the comment. I’m guessing I’ve still got something that isn’t quite right in my setup then, getting nowhere close to 1k hits per day. Back to the drawing board to see where I’ve got an issue…..

Andrew

]]> By: Lukas http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-153 Tue, 01 Dec 2009 21:33:57 +0000 http://infosanity.wordpress.com/?p=389#comment-153 Hey Andrew, thank you for the feedback! How many hits did you get? A standard Glastopf Sensor should get more than 1k hits per day. Currently it should be mainly remote file inclusion attacks.

Greetings,
Lukas

]]> By: Andrew Waite http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-152 Tue, 01 Dec 2009 19:33:42 +0000 http://infosanity.wordpress.com/?p=389#comment-152 Trying to clear my to-do list for a quiet holiday period. Not worth the grief from family and friends when I try to finish up a bit of coding in the middle of Christmas dinner ;) Attempting to actually unplug from the matrix for more than a 24hour period this year.

]]> By: lvdeijk http://blog.infosanity.co.uk/2009/12/01/starting-out-with-glastopf/#comment-151 Tue, 01 Dec 2009 19:29:17 +0000 http://infosanity.wordpress.com/?p=389#comment-151 As said on a tweet. Man get some R&R :) Good research, well done, but seriously get some rest…;)

]]>